I am currently creating a Graylog test setup with many clients sending to one Graylog server over Syslog TCP.
This Graylog Server forwards part of the messages to another Graylog server.
There will be about 40-50 clients that send their logs via Syslog TCP to the first Graylog server.
Is it sufficient to configure the same TCP destination port (e.g. 601) as input port on Graylog?
Or might it be better to use a dedicated input port for each client?
I’m concerned that many clients trying to establish a TCP connection on the same port will decrease performance.